fix(workspace): restore theme design-system, fix 5x note creation, enforce privacy isolation, fix shared write permission, add drag-drop & slash-commands

internal/api/server.go

@@ -836,7 +836,6 @@ func (s *Server) handleCreateDocument(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	s.wsHub.BroadcastDocEvent(doc.ID, "DOC_CREATED", doc)
 	s.broadcastDocToAuthorizedUsers(doc.ID, "DOC_CREATED")
 	writeJSON(w, http.StatusCreated, doc)
 }
@@ -890,7 +889,6 @@ func (s *Server) handleUpdateDocument(w http.ResponseWriter, r *http.Request) {
 		s.wsHub.SyncActiveDocRoom(docID, doc.Title, doc.Blocks)
 	}
 	if req.Title != nil || req.Icon != nil || req.FolderPath != nil || req.Blocks != nil || req.Tags != nil {
-		s.wsHub.BroadcastDocEvent(docID, "DOC_UPDATED", doc)
 		s.broadcastDocToAuthorizedUsers(docID, "DOC_UPDATED")
 	}
 	writeJSON(w, http.StatusOK, doc)
@@ -936,6 +934,8 @@ func (s *Server) handlePatchDocumentBlocks(w http.ResponseWriter, r *http.Reques
 func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	docID := chi.URLParam(r, "id")
+	authorizedUsers, _ := s.store.GetAuthorizedDocUsers(docID)
+
 	if s.wsHub != nil {
 		s.wsHub.CloseDocRoom(docID)
 	}
@@ -943,7 +943,9 @@ func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
-	s.wsHub.BroadcastDocEvent(docID, "DOC_DELETED", map[string]string{"id": docID})
+	for _, uid := range authorizedUsers {
+		s.wsHub.BroadcastToUser(uid, "DOC_DELETED", map[string]string{"id": docID})
+	}
 	writeJSON(w, http.StatusOK, map[string]bool{"deleted": true})
 }
 
@@ -1355,16 +1357,19 @@ func (s *Server) handleDocWebSocket(w http.ResponseWriter, r *http.Request) {
 		userID = "anonymous"
 	}
 
+	canWrite := false
 	if userID != "anonymous" {
-		if _, err := s.store.GetDocumentByID(userID, docID); err != nil {
+		doc, err := s.store.GetDocumentByID(userID, docID)
+		if err != nil {
 			writeError(w, http.StatusForbidden, "Kein Zugriff auf dieses Dokument")
 			return
 		}
+		canWrite = doc.IsOwner || doc.Permission == "owner" || doc.Permission == "write"
 	}
 
 	clientID := r.URL.Query().Get("clientId")
 	room := s.wsHub.GetOrCreateDocRoom(docID)
-	room.ServeDocWS(w, r, userID, clientID)
+	room.ServeDocWS(w, r, userID, clientID, canWrite)
 }
 
 // --- REALTIME LISTS & SHARING ---

internal/ws/docroom.go

@@ -18,6 +18,7 @@ type DocWSClient struct {
 	conn     *websocket.Conn
 	userID   string
 	clientID string
+	canWrite bool
 	send     chan []byte
 }
 
@@ -433,7 +434,7 @@ func (r *DocRoom) Flush() {
 }
 
 // ServeDocWS handles WebSocket connections for GET /api/v1/ws/docs/{id}
-func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID string, clientID string) {
+func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID string, clientID string, canWrite bool) {
 	conn, err := upgrader.Upgrade(w, req, nil)
 	if err != nil {
 		log.Printf("[doc-ws] upgrade error for doc %s: %v", r.docID, err)
@@ -453,6 +454,7 @@ func (r *DocRoom) ServeDocWS(w http.ResponseWriter, req *http.Request, userID st
 		conn:     conn,
 		userID:   userID,
 		clientID: clientID,
+		canWrite: canWrite,
 		send:     make(chan []byte, 256),
 	}
 
@@ -509,6 +511,10 @@ func (c *DocWSClient) readPump() {
 
 		var evt DocSyncEvent
 		if err := json.Unmarshal(message, &evt); err == nil && evt.Type != "" {
+			if !c.canWrite {
+				// Read-only clients cannot mutate the document
+				continue
+			}
 			c.room.HandleEvent(evt, c)
 		}
 	}

internal/ws/hub.go

@@ -499,7 +499,9 @@ func (h *Hub) BroadcastTaskEvent(userID, event string, payload interface{}) {
 }
 
 func (h *Hub) BroadcastDocEvent(docID, event string, payload interface{}) {
-	h.BroadcastToAll(event, payload)
+	if docID != "" {
+		h.BroadcastRoom("doc:"+docID, event, payload, nil)
+	}
 }
 
 func (h *Hub) Broadcast(spaceID, listID, event string, payload interface{}) {